registry / @mastra/deployer-vercel / 1.2.5

@mastra/deployer-vercel@1.2.5

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 2.46 MB of source, external domains: aomediacodec.github.io, cloud-api.livekit.io, mastra.ai, prettier.io, radix-ui.com, react.dev

Oversized source lightweight scan

dist/studio/assets/main-D9a0smyR.js6.53 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringsmastra.airadix-ui.comreact.dev

Source & flagged code

4 flagged

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/babel-CmeIX3PZ.jsView file

Lines 1-16javascript

1var ns=Object.defineProperty,Fe=(t,e)=>{for(var s in e)ns(t,s,{get:e[s],enumerable:!0})},os={};Fe(os,{parsers:()=>aa});var wt={};Fe(wt,{__babel_estree:()=>Qi,__js_expression:()=>St,__ts_expression:()=>Et,__vue_event_binding:()=>bt,__vue_expression:()=>St,__vue_ts_event_binding:()=>At,__vue_ts_expression:()=>Et,babel:()=>bt,"babel-flow":()=>ss,"babel-ts":()=>At});function ls(t,e){if(t==null)return{};var s={};for(var r in t)if({}.hasOwnProperty.call(t,r)){if(e.indexOf(r)!==-1)continue;s[r]=t[r]}return s}var z=class{line;column;index;constructor(t,e,s){this.line=t,this.column=e,this.index=s}},fe= ...

2- Did you mean \`export { '${t}' as '${e}' } from 'some-module'\`?`,ExportDefaultFromAsIdentifier:"'from' is not allowed as an identifier after 'export default'.",ForInOfLoopInitializer:({type:t})=>`'${t==="ForInStatement"?"for-in":"for-of"}' loop variable declaration may not have an initializer.`,ForInUsing:"For-in loop may not start with 'using' declaration.",ForOfAsync:"The left-hand side of a for-of loop may not be 'async'.",ForOfLet:"The left-hand side of a for-of loop may not start with 'let'.",GeneratorInSingleStatementContext:"Generators can only be declared at the top level or inside ..

3- Did you mean \`import { "${t}" as foo }\`?`,ImportCallArity:"`import()` requires exactly one or two arguments.",ImportCallNotNewExpression:"Cannot use new with import(...).",ImportCallSpreadArgument:"`...` is not allowed in `import()`.",ImportJSONBindingNotDefault:"A JSON module can only be imported with `default`.",ImportReflectionHasAssertion:"`import module x` cannot have assertions.",ImportReflectionNotBinding:'Only `import module x from "./module"` is valid.',IncompatibleRegExpUVFlags:"The 'u' and 'v' regular expression flags cannot be enabled at the same time.",InvalidBigIntLiteral:"In ...

4`:`\r

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2

5`):r=String.fromCharCode(s),++this.state.curLine,this.state.lineStart=this.state.pos,r}jsxReadString(e){let s="",r=++this.state.pos;for(;;){if(this.state.pos>=this.length)throw this.raise(c.UnterminatedString,this.state.startLoc);let i=this.input.charCodeAt(this.state.pos);if(i===e)break;i===38?(s+=this.input.slice(r,this.state.pos),s+=this.jsxReadEntity(),r=this.state.pos):W(i)?(s+=this.input.slice(r,this.state.pos),s+=this.jsxReadNewLine(!1),r=this.state.pos):++this.state.pos}s+=this.input.slice(r,this.state.pos++),this.finishToken(134,s)}jsxReadEntity(){let e=++this.state.pos;if(this.codePo ...

6`,++s,g===13&&e.charCodeAt(s)===10&&++s,++i,d=r=s):a.unterminated(n,o,h):++s}return{pos:s,str:l,firstInvalidLoc:u,lineStart:r,curLine:i}}function lr(t,e,s,r){return t==="template"?e===96||e===36&&

7`);case 114:return o("\r");case 120:{let l;return{code:l,pos:e}=ve(t,e,s,r,2,!1,n,a),o(l===null?null:String.fromCharCode(l))}case 117:{let l;return{code:l,pos:e}=Ut(t,e,s,r,n,a),o

8`),cooked:i===null?null:i.slice(1,h)},n.tail=o,this.next();let u=this.finishNode(n,"TemplateElement");return this.resetEndLocation(u,L(this.state.lastTokEndLoc,h)),u}parseTemplate(t){let e=this.startNode(),s=this.parseTemplateElement(t),r=[s],i=[];for(;!s.tail;)i.push(this.parseTemplateSubstitution()),this.readTemplateContinuation(),r.push(s=this.parseTemplateElement(t));return e.expressions=i,e.quasis=r,this.finishNode(e,"TemplateLiteral")}parseTemplateSubstitution(){return this.parseExpression()}parseObjectLike(t,e,s,r){s&&this.expectPlugin("recordAndTuple");let i=this.state.inFSharpPipeline ...

9`||t==="\r"||t==="\u2028"||t==="\u2029";function qr(t,e,s){let r=!!s?.backwards;if(e===!1)return!1;let i=t.charAt(e);if(r){if(t.

10`)return e-2;if(mt(i))return e-1}else{if(i==="\r"&&t.charAt(e+1)===`

11`)return e+2;if(mt(i))return e+1}return e}var $r=qr;function Kr(t,e){return e===!1?!1:t.charAt(e)==="/"&&t.charAt(e+1)==="/"?

12`);return e===-1?t:t.slice(0,e)}var Wt=Yr,We=(t,e)=>(s,r,...i)=>s|1&&r==null?void 0:(e.call(r)??r[t]).apply

13`);return e.length>1&&e.every(s=>s.trimStart()[0]==="*")}var Ce=new WeakMap;function ci(t){return Ce.has(t)||Ce.set(t,pi(t)),Ce.get(t)}var ft=ci;function ui(t){if(t.length<2)return;let e;for(let s=t.length-1;s>=0;s--){let r=t[s];if(e&&F(r)===R(e)&&ft(r)&&ft(e)&&(t.splice(s+1,1),r.value+="*//*"+e.value,r.range=[R(r),F(e)]),!oi(r)&&!Ge(r))throw new TypeError(`Unknown comment type: "${r.type}".`);e=r}}var di=ui;function mi(t){return t!==null&&typeof t=="object"}var fi=mi,ee=null;function ie(t){if(ee!==null&&typeof ee.property){let e=ee;return ee=ie.prototype=null,e}return ee=ie.prototype=t??Objec ...

14$1 $2

15`);t=t.replace(xt,"").trimEnd();let s=Object.create(null),r=he(0,t,Pt,"").replace(xt,"").trimEnd(),i;for(;i=Pt.exec(t);){let a=he(0,i[2],Di,"");if(typeof

Long lines were clipped for display.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file

•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2 kind = high_entropy_blob sizeBytes = 68648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkg

dist/studio/assets/main-D9a0smyR.jsView file

•path = dist/studio/assets/main-D9a0smyR.js kind = oversized_source_file sizeBytes = 6848792 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio/assets/main-D9a0smyR.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/babel-CmeIX3PZ.jsView file

2- Did you mean \`export { '${t}' as '${e}' } from 'some-module'\`?`,ExportDefaultFromAsIdentifier:"'from' is not allowed as an identifier after 'export default'.",ForInOfLoopInitia... L3: - Did you mean \`import { "${t}" as foo }\`?`,ImportCallArity:"`import()` requires exactly one or two arguments.",ImportCallNotNewExpression:"Cannot use new with import(...).",Impo... L4: `:`\r

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file

•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2 kind = high_entropy_blob sizeBytes = 68648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkg

dist/studio/assets/main-D9a0smyR.jsView file

•path = dist/studio/assets/main-D9a0smyR.js kind = oversized_source_file sizeBytes = 6848792 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio/assets/main-D9a0smyR.jsView on unpkg

Findings

2 High6 Medium5 Low

HighShips High Entropy Blobdist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2

HighOversized Source Filedist/studio/assets/main-D9a0smyR.js

MediumSecret Patterndist/studio/assets/livekit-client.esm-CKIgC2IJ.js

MediumDynamic Requiredist/studio/assets/babel-CmeIX3PZ.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/babel-CmeIX3PZ.jsView file

Lines 1-16javascript

4`:`\r

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2

6`,++s,g===13&&e.charCodeAt(s)===10&&++s,++i,d=r=s):a.unterminated(n,o,h):++s}return{pos:s,str:l,firstInvalidLoc:u,lineStart:r,curLine:i}}function lr(t,e,s,r){return t==="template"?e===96||e===36&&

7`);case 114:return o("\r");case 120:{let l;return{code:l,pos:e}=ve(t,e,s,r,2,!1,n,a),o(l===null?null:String.fromCharCode(l))}case 117:{let l;return{code:l,pos:e}=Ut(t,e,s,r,n,a),o

9`||t==="\r"||t==="\u2028"||t==="\u2029";function qr(t,e,s){let r=!!s?.backwards;if(e===!1)return!1;let i=t.charAt(e);if(r){if(t.

10`)return e-2;if(mt(i))return e-1}else{if(i==="\r"&&t.charAt(e+1)===`

11`)return e+2;if(mt(i))return e+1}return e}var $r=qr;function Kr(t,e){return e===!1?!1:t.charAt(e)==="/"&&t.charAt(e+1)==="/"?

12`);return e===-1?t:t.slice(0,e)}var Wt=Yr,We=(t,e)=>(s,r,...i)=>s|1&&r==null?void 0:(e.call(r)??r[t]).apply

14$1 $2

15`);t=t.replace(xt,"").trimEnd();let s=Object.create(null),r=he(0,t,Pt,"").replace(xt,"").trimEnd(),i;for(;i=Pt.exec(t);){let a=he(0,i[2],Di,"");if(typeof

Long lines were clipped for display.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file

•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2 kind = high_entropy_blob sizeBytes = 68648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkg

dist/studio/assets/main-D9a0smyR.jsView file

•path = dist/studio/assets/main-D9a0smyR.js kind = oversized_source_file sizeBytes = 6848792 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio/assets/main-D9a0smyR.jsView on unpkg